teleport

As part of a routine security audit of Teleport, a security vulnerability was discovered that affects all recent releases of Teleport. We strongly suggest upgrading to the latest patched release to mitigate this vulnerability.

Details

Due to a flaw in how the Teleport Web UI handled host certificate validation, host certificate validation was disabled for clusters where connections were terminated at the node. This means that an attacker could impersonate a Teleport node without detection when connecting through the Web UI.

Clusters where sessions were terminated at the proxy (recording proxy mode) are not affected.

Command line programs like tsh (or ssh) are not affected by this vulnerability.

Actions

To mitigate this issue, upgrade and restart all Teleport proxy processes.

Downloads

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

As part of a routine security audit of Teleport, a security vulnerability was discovered that affects all recent releases of Teleport. We strongly suggest upgrading to the latest patched release to mitigate this vulnerability.

Details

Due to a flaw in how the Teleport Web UI handled host certificate validation, host certificate validation was disabled for clusters where connections were terminated at the node. This means that an attacker could impersonate a Teleport node without detection when connecting through the Web UI.

Clusters where sessions were terminated at the proxy (recording proxy mode) are not affected.

Command line programs like tsh (or ssh) are not affected by this vulnerability.

Actions

To mitigate this issue, upgrade and restart all Teleport proxy processes.

Downloads

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains a bug fix.

Description

• Fixed a regression in certificate re-issuance that could cause nodes to not start. #3449

This releases includes the following bug fixes from 4.2.5.

• Added support for custom OIDC prompts. #3409
• Added support for kubernetes_users in roles. #3409
• Added support for extended variable interpolation. #3409
• Added SameSite attribute to CSRF cookie. #3441

This release also includes the following bug fixes from 4.2.4.

• Fixed issue where Teleport could connect to the wrong node and added support to connect via UUID. #2396
• Fixed issue where tsh login would fail to output identity when using the --out parameter. #3339

Actions

We recommend all users running Teleport 4.2.4 and 4.2.5 to upgrade nodes to this release

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download

This release of Teleport contains bug fixes and security fixes.

Description

This release of Teleport contains bug and security fixes.

• Mitigated CVE-2020-9283 by updating golang.org/x/crypto.
• Fixed PAM integration to support user creation upon login. #3317 #3346
• Improved Teleport performance on large IoT clusters. #3227
• Added support for PluginData to Teleport plugins. #3286 #3298

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains a security fix.

Description

• Mitigated CVE-2020-9283 by updating golang.org/x/crypto.

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains a security fix.

Description

• Mitigated CVE-2020-9283 by updating golang.org/x/crypto.

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains a security fix.

Description

• Mitigated CVE-2020-9283 by updating golang.org/x/crypto.

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains a bug fix and security fix.

Description

• Fixed a regression in role mapping between trusted clusters. #3252
• Mitigated CVE-2020-9283 by updating golang.org/x/crypto.

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download

This release of Teleport contains bug fixes and improvements.

Description

• Fixed a regression in role mapping between trusted clusters. #3252
• Improved variety of issues with Enhanced Session Recording including support for more opearting systems and install from packages. #3279

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains bug fixes and improvements.

Description

• Fixed a regression in role mapping between trusted clusters. #3252

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains bug fixes and improvements.

Description

• Fixed a regression in role mapping between trusted clusters. #3252

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains bug fixes and improvements.

Description

• Fixed a regression in role mapping between trusted clusters. #3252

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

This release of Teleport contains bug fixes and minor usability improvements.

Description

• New build command for client-only (tsh) .pkg builds. #3159
• Added support for etcd password auth. #3234
• Added third-party S3 support. #3234
• Fixed an issue where access-request event system fails when cache is enabled. #3223
• Fixed cgroup resolution so enhanced session recording works on Debian based distributions. #3215

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download

This is a major Teleport release with a focus on new features and bug fixes.

Improvements

• Alpha: Enhanced Session Recording lets you know what's really happening during a Teleport Session. Read the docs. #2948
• Alpha: Workflows API lets admins escalate RBAC roles in response to user requests. Read the docs. #3006
• Beta: Teleport provides HA Support using Firestore and Google Cloud Storage using Google Cloud Platform. Read the docs. #2821
• Remote tctl execution is now possible. Read the docs. #1525 #2991

Fixes

• Fixed issue in socks4 when rendering remote address. #3110

Documentation

• Adopting root/leaf terminology for trusted clusters. Trusted cluster documentation.
• Documented Teleport FedRAMP & FIPS Support. FedRAMP & FIPS documentation.

This release of Teleport contains a bug fix.

Description

• Fixed issue where the port forwarding option in a role was ignored. #3208

Download

Download the current and previous releases of Teleport at https://gravitational.com/teleport/download.